Inspect and verify JSON Web Tokens
The JWT Decoder unpacks a JSON Web Token into its three readable parts — header, payload and signature — displaying the decoded claims in pretty-printed JSON with issued-at and expiry timestamps translated into human time. Optional HMAC signature verification confirms a token's integrity when you supply the secret.
JWTs are base64url, not encrypted — a fact every developer should see once. Pasting a token here and reading its claims (who it belongs to, what roles it grants, when it expires) is the fastest way to debug authentication issues and to internalise what a token actually reveals.
Decoding and verification run entirely in your browser: tokens pasted during debugging — which often contain user identifiers and permissions — never leave your device. The tool decodes and verifies; it never sends, stores or logs your tokens.
Like every Piclizer tool, this one runs entirely in your browser — your files stay on your device.